Cross-cluster coverage
See node health and version drift across every connected cluster.
Falco for Kubernetes
Operate Falco consistently across Kubernetes clusters
The Falco Operator provides Kubernetes-native deployment primitives. OpenFalco is planned to add an organization-level view across clusters and a workflow for security teams.
Cluster-native does not mean organization-wide
Teams still need to compare coverage across clusters, group repeated pod events, manage environment-specific exceptions, and prove which rules are active where.
Workload context
Triage events with namespace, pod, image, process, and user evidence.
Controlled rollout
Stage rule changes by cluster or node group with rollback and audit.
OpenFalco complements the open-source Kubernetes deployment stack rather than replacing it.
Reserve founding accessDoes a pod count as a billable node?
No. Only each protected Kubernetes worker node counts. Pods and alert volume are not billed.
Does OpenFalco replace the Falco Operator?
No. The Operator can remain the Kubernetes deployment mechanism; OpenFalco adds cross-environment visibility and workflow.